Bump github/codeql-action from 4 to 4.37.3 - #3561
Conversation
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4...v4.37.3) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
the
dependencies
dependabot
Bot
added
minor
github_actions
![semgrep-code-mongodb[bot]](https://avatars.githubusercontent.com/u/45120?s=60&v=4){kind=small}
| - name: Upload SARIF report | ||
| if: ${{ github.event_name == 'workflow_dispatch' }} | ||
| uses: github/codeql-action/upload-sarif@v4 | ||
| uses: github/codeql-action/upload-sarif@v4.37.3 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
The github/codeql-action/upload-sarif@v4.37.3 step uses a mutable tag, so a repointed tag could make this workflow run attacker-controlled code.
More details about this
github/codeql-action/upload-sarif@v4.37.3 is not pinned to a full 40-character commit SHA, so this workflow trusts whatever code the v4.37.3 tag points to when the Upload SARIF report step runs.
A plausible attack looks like this:
- An attacker compromises the
github/codeql-actionrepository or its release process. - They move the
v4.37.3tag to a new commit that keeps the action name the same but adds malicious behavior. - Your workflow reaches
uses: github/codeql-action/upload-sarif@v4.37.3after./vendor/bin/phpstan analysecreatesphpstan.sarif. - The malicious action now runs in your GitHub Actions job with access to the job token and workspace contents, including files produced earlier in the job and values passed in
with:such assarif_file: phpstan.sarif. - In the
workflow_dispatchpath, the same action also receivesref: ${{ inputs.ref }}andsha: ${{ env.CHECKED_OUT_SHA }}, which could help an attacker tie stolen data or malicious updates to a specific revision.
Because the reference is mutable, the code executed here can change later without any change to this workflow file.
To resolve this comment:
✨ Commit fix suggestion
- Replace the mutable action reference
github/codeql-action/upload-sarif@v4.37.3with a full 40-character commit SHA for the exact release you intend to use. - Keep the version as a comment next to the SHA so the workflow stays readable, for example:
uses: github/codeql-action/upload-sarif@<full-40-char-sha> # v4.37.3. - Apply the same change to both
Upload SARIF reportsteps, since both currently use the same mutable tag. - Get the correct commit SHA from the
github/codeql-actionrepository release or tag page forv4.37.3, and make sure you use the full SHA, not a shortened one. Pinning to a commit SHA prevents the action owner from silently moving the tag to different code later.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
🛟 Help? Slack #semgrep-help or go/semgrep-help.
Resolution Options:
- Fix the code
- Reply
/fp $reason(if security gap doesn’t exist) - Reply
/ar $reason(if gap is valid but intentional; add mitigations/monitoring) - Reply
/other $reason(e.g., test-only)
You can view more details about this finding in the Semgrep AppSec Platform.
| - name: Upload SARIF report | ||
| if: ${{ github.event_name != 'workflow_dispatch' }} | ||
| uses: github/codeql-action/upload-sarif@v4 | ||
| uses: github/codeql-action/upload-sarif@v4.37.3 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
github/codeql-action/upload-sarif@v4.37.3 uses a mutable tag, so the action owner or an attacker who compromises that repo could silently swap in different code. That code would run during the SARIF upload step with your CI job’s access to the workspace, token, and workflow data.
More details about this
github/codeql-action/upload-sarif@v4.37.3 is pulled by a version tag, not an exact commit, in the Upload SARIF report step. If the owner of github/codeql-action or anyone who compromises that repository repoints v4.37.3 to different code, this workflow will run the new action code with this job’s permissions when it uploads phpstan.sarif.
A plausible attack looks like this:
- An attacker gains control of the
github/codeql-actionrepository or its release process. - They move the
v4.37.3tag souses: github/codeql-action/upload-sarif@v4.37.3now resolves to attacker-controlled code. - Your workflow reaches the Upload SARIF report step after
composer installand./vendor/bin/phpstan analyse ... > phpstan.sarifhave already run, so the malicious action executes inside your CI job. - That action can read files in the workspace such as
phpstan.sarif, inspect environment variables, and use the job’s GitHub token or other available secrets to make API calls. - In the
workflow_dispatchpath, it also receivesref: ${{ inputs.ref }}andsha: ${{ env.CHECKED_OUT_SHA }}, which gives the attacker extra context about what commit is being analyzed while they exfiltrate data or tamper with results.
Because the reference is mutable, the code that runs in CI can change silently without any workflow diff in your repository.
To resolve this comment:
✨ Commit fix suggestion
- Replace the mutable action reference with a full 40-character commit SHA in the
uses:line. - Keep the released version as a comment so the pinned commit is still easy to identify, for example:
uses: github/codeql-action/upload-sarif@<full-40-char-sha> # v4.37.3. - Get the correct commit SHA from the
github/codeql-actionrepository release or tag page forv4.37.3, and use that exact commit instead of the version tag. Pinning to a commit prevents the action owner from silently changing what runs for the same tag.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
🛟 Help? Slack #semgrep-help or go/semgrep-help.
Resolution Options:
- Fix the code
- Reply
/fp $reason(if security gap doesn’t exist) - Reply
/ar $reason(if gap is valid but intentional; add mitigations/monitoring) - Reply
/other $reason(e.g., test-only)
You can view more details about this finding in the Semgrep AppSec Platform.
|
@dependabot ignore this minor version The issue is the |
|
OK, I won't notify you about version 4.37.x again, unless you re-open this PR. |
1 participant
Bumps github/codeql-action from 4 to 4.37.3.
Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
Commits
e4fba86Merge pull request #4031 from github/update-v4.37.3-72f6a9da0fb50ab5Update changelog for v4.37.372f6a9dMerge pull request #4030 from github/mbg/fix/no-proxy3b5ee58Use defaultrequestoptions instead ofundefinedbfb6be4Merge pull request #4028 from github/mergeback/v4.37.2-to-main-e0647621526ab84Rebuildd6217b9Update changelog and version after v4.37.2e064762Merge pull request #4027 from github/update-v4.37.2-385bcdc5ae0faed8Add a couple of change notes73aad0eUpdate changelog for v4.37.2Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)